How do I manage the content of my alert?

[pdjhh]

Hi,

I have set up a couple of alerts and have chosen an inline table in the subsequent email. The contents of that table, however, seem almost totally random. Does anyone know where those fields come from and how they can be changed? I can see a display.events.fields setting in savedsearches, but I don't know if this has any bearing on it nor where the current fields in there came from. If I change them, it doesn't affect the content of the alert email.

The search is simply looking for values over a particular numeric threshold:

sourcetype=dbcsv  | eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90

Ideally I'd like the email to contain a table that I can produce on a dashboard: _time, DataFileSizeMB, LogFileSizeMB, percent_used

Thanks.

[somesoni2 · Accepted solution]

Use this as your alert search

sourcetype=dbcsv | table _time, DataFileSizeMB, LogFileSizeMB, percent_used| eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90

[pdjhh]

OK great thanks that works. I had a table command in it previously and the whole alert wouldn't work but that must have been to do with some fields I had in the root search. This solution works and I can add what I need, thanks.